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Abstract 

Atomic  clocks  for  use  in  operational  satellites  such  as  GPS  and  MILSTAR  are  a  breed  apart 
from  their  terrestrial  cousins .  Like  most  space  electronic  packages ,  clocks  will  seem  to  be  a 
generation  behind  the  technology  used  in  other  applications .  The  reasons  for  this  include  the 
need  for  high  reliability  parts ,  radiation  hardness ,  and  mechanical  design .  Other  key  drivers  in 
the  designs  include  zero  gravity ,  unattended  operation ,  limited  monitoring  bandwidth ,  and 
limits  on  weight  size  and  power \  Clocks  used  in  short-term  space  experiments  can  be  closer  in 
design  to  ground  clocks ,  but  are  generally  not  usable  for  operational  systems  without  extensive 
modifications . 


INTRODUCTION 

Satellites  have  included  frequency  standards  since  the  beginning  of  the  space  age.  The  advent  of  systems 
such  as  TIMATION,  TRANSIT,  and  GPS  brought  the  need  for  better  clocks.  Spacecraft  Atomic  Clocks 
have  been  a  key  and  unique  parameter  of  the  development  and  deployment  of  GPS.  These  clocks  provide 
the  high  stability  required  for  accurate  navigation  performance,  and  their  development  for  space  needed  to 
provide  the  highest  stability  reliably  for  the  years  required  from  the  satellite.  It  was  more  than  a  matter  of 
simply  putting  a  good  ground  clock  on  a  satellite.  The  launch  process  involves  high  levels  of  vibration  and 
acceleration,  and  there  are  radical  differences  in  environment  while  in  space  that  will  upset  most  clock 
designs.  Long  life  and  error-free  optimum  performance  within  the  limited  size,  weight,  and  power  are  all 
critical. 

Space  atomic  clock  technology  makes  accurate  performance  inherent  in  the  system,  but  at  the  same  time 
the  reliability  and  operation  of  these  devices  in  the  system  must  insure  continuity  and  integrity  of 
performance.  Investment  in  this  technology  is  necessary  to  maintain  commercial  interest  and  viability  for 
production.  GPS  is  the  dominant  user  of  high  precision  and  stable  space  atomic  clocks;  the  only  other 
users  are  the  few  MILSTAR  satellites  containing  rubidium  standards  with  relatively  relaxed  requirements. 
As  such,  GPS  has  been  virtually  the  sole  supporter  of  this  technology,  and  NRL  has  been  the  leader  in  their 
development  and  application  [1]. 


SPACE  TECHNOLOGY 

The  principal  objectives  of  atomic  clocks  in  operational  satellites  are: 

1.  Stability  and  predictability  of  maintaining  synchronization  over  the  operational  lifetime  of  the 
satellite, 

2.  Reliable  continuity  of  the  signal  provided. 
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3.  Ability  of  the  system  operators  to  anticipate  and  prevent  signal  anomalies, 

4.  Ability  of  the  system  operators  to  diagnose  anomalies  for  immediate  corrective  action,  and 

5.  Programmatic  issue  of  having  adequate  production  source(s)  of  these  devices. 


These  objectives  add  to  the  demands  of  designing  for  operating  and  surviving  in  the  space  environment. 
The  developer  would  then  need  to  take  this  into  account  in  the  overall  unit  design  and  in  the  nature  of  the 
validation  test  program  to  verify  the  design  and  ensure  clock  operation  in  the  satellite  integration, 
functional  testing,  and  final  in-orbit  operation. 


DESIGN  ISSUES 

Size,  weight,  and  power  are  major  factors  in  the  design  of  satellite  hardware.  Satellites  and  even  space 
stations  will  always  be  subject  to  these  limitations.  To  justify  large  amounts  of  these  scarce  resources,  the 
item  must  be  very  critical  to  mission  success  and  there  can  be  no  easy  alternative  to  using  it.  A  laboratory 
hydrogen  maser  with  a  volume  of  over  a  cubic  meter,  weighing  more  than  100  kilograms  and  drawing  over 
150  watts,  is  unlikely  to  find  a  home  in  space  if  a  rubidium  clock  a  fraction  of  that  size  meets  the 
requirements. 

The  issue  for  the  space  clock  designer  is  to  make  a  clock  that  meets  his  performance  goals  while 
minimizing  size,  weight,  and  power.  That  may  force  the  designer  to  choices  of  exotic  materials  such  as 
titanium  to  minimize  weight  while  adding  the  strength  needed  to  survive  launch.  In  the  example  case  of 
hydrogen  masers,  reducing  the  volume  led  to  using  smaller  RF  cavities  with  lower  Q  factors.  That,  in-tum, 
led  to  passive  and  q-multiplier  operating  modes. 


LAUNCH  ENVIRONMENT 

One  of  the  hardest  initial  problems  in  making  a  space  clock  is  designing  it  to  survive  the  launch.  Launch 
environments  vary  widely  depending  on  the  payload  and  booster.  The  Space  Shuttle,  for  example,  is  a 
manned  mission  and  is  designed  to  carry  a  wide  variety  of  items  to  low-earth  orbit.  At  the  other  end  of  the 
spectrum,  sounding  rockets  are  designed  for  short,  inexpensive  missions  and  often  have  very  harsh  rides. 
Missions  such  as'the  Global  Positioning  System  fall  in  between,  with  typical  accelerations  up  to  20  g’s  and 
random  vibration  levels  up  to  19.8  g’s.  Early  in  NRL’s  work  on  GPS,  vibration  tests  were  done  on 
commercially  available  cesium  and  rubidium  clocks  [2,3].  All  test  units  failed.  The  rubidium  clock’s 
glassware  broke  and  numerous  internal  ceramic  insulators  failed  in  the  cesium  beam  tube.  Screws  back 
out,  large  components  break  loose,  circuit  boards  flex. 

The  remedies  for  the  circuit  board  problems  are  well  known  in  the  space  industry.  Conformal  coating  of 
circuit  cards  is  done  to  capture  components  and  prevent  them  from  resonating  with  the  driving  vibration 
forces.  Circuit  card  mounting  is  designed  to  avoid  long  unsupported  areas  that  can  resonate  at  low 
frequencies.  Wiring  is  bundled  and  secured.  Some  designers  avoid  the  use  of  connectors;  others  use 
proven  design  connectors. 

The  more  difficult  problem  is  the  physics  unit.  There  the  mechanics  are  not  just  issues  of  mounting 
components,  but  of  providing  radio  frequency  cavities  with  precision  alignments.  A  structure  might 
survive  vibration  in  the  sense  of  not  coming  apart,  but  still  would  not  function  as  required. 

Acceleration  is  not  usually  as  significant  as  vibration,  since  it  is  rarely  high  enough  to  break  anything. 
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However,  if  the  standard  has  to  operate  through  launch  and  meet  performance  specifications,  deformation 
of  cavities  and  misalignment  of  beams  can  be  a  problem. 


ON-ORBIT  ENVIRONMENT 

Once  the  clock  makes  it  successfully  to  orbit,  it  must  be  able  to  run  properly  in  that  environment  for  its 
design  lifetime.  The  shorter  the  design  life,  the  easier  it  is  to  make  the  clock.  Additional  complications  are 
the  lack  of  gravity  and  air.  Reliability  is  particularly  important  in  a  space  clock,  since  repair  is  usually 
impractical  if  not  impossible.  The  key  factors  in  stable  operation  and  long  life  are:  thermal  control,  parts 
selection,  and  radiation  exposure. 


Zero  G 

The  cesium  and  rubidium  clocks  flown  to  date  have  not  been  seriously  impacted  by  the  lack  of  gravity. 
There  is  essentially  no  effect  on  rubidium  clocks,  since  the  physics  unit  has  no  directed  flow  of  atoms  and 
no  mechanically  moving  parts.  Cesium  beam  tubes  do  have  a  beam  of  moving  atoms,  but  the  beam  design 
for  commercial  tubes  assumes  no  significant  deflection  of  the  beam  by  gravity.  There  have  been  some 
enhancements  done  in  the  cesium  ovens  to  improve  their  operation. 

With  new  technologies,  such  as  cesium  fountains,  the  picture  changes.  The  classic  fountain  with  a  beam  of 
atoms  rising  and  then  falling  back  won't  work  without  gravity  to  pull  the  atoms  back.  However,  the  lack  of 
gravity  makes  cold  atom  beam  tubes  interesting,  since  there  isn’t  a  force  to  deflect  a  slow  moving  beam. 


Zero  Pressure  and  Thermal  Effects 

The  lack  of  air  has  two  effects.  First,  structures  such  as  vacuum  enclosures  containing  RF  cavities  are 
designed  to  resonate  with  a  given  set  of  barometrically  induced  stresses.  With  no  air  pressure,  the  forces 
change  and  the  resonance  frequency  will  change  as  the  cavity  deforms.  This  effect  was  an  early  problem 
in  hydrogen  masers,  which  had  large  frequency  offsets  occur  as  weather  fronts  passed  through.  Most 
clocks,  including  crystal  oscillators,  have  noticeable  frequency  shifts  as  they  go  from  air  to  vacuum.  A 
large  part  of  that  effect  is  really  a  thermal  problem. 

Electronic  circuits  are  designed  to  be  able  to  emit  or  transfer  excess  heat.  Most  circuits  built  for  terrestrial 
applications  use  airflow  as  at  least  part  of  their  thermal  design.  When  there’s  no  air  to  conduct  heat  away 
from  components,  either  the  heat  travels  by  another  path  or  the  component  overheats.  As  in  the  vibration 
issues,  the  aerospace  industry  has  found  solutions  for  thermal  hot  spots.  Heat  is  either  conducted  away 
through  solid  paths  or  radiated  to  cooler  surfaces.  Thermal  design  is  critical  for  reliability.  The  projected 
lifetime  of  an  electronic  part  is  directly  related  to  its  temperature.  Some  of  the  most  difficult  thermal 
design  problems  can  be  RF  power  circuits,  where  circuit  design  limits  the  use  of  conduction  paths  for  heat. 
In  such  components,  even  though  the  device  case  temperature  is  within  good  design  limits;  the  junction 
temperature  inside  may  be  critically  high. 

The  thermal  environment  on  an  orbiting  satellite  is  usually  designed  to  be  benign,  with  base  temperatures 
near  room  temperature  and  only  a  few  degrees  excursion  around  the  orbit.  GPS  has  demonstrated  that 
some  of  its  clocks  run  better  on-orbit  than  in  the  laboratory.  It’s  not  really  that  simple,  though.  Typically, 
a  spacecraft  electronic  package  must  be  designed  to  operate  over  a  wide  range  of  temperatures,  because  the 
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satellite  thermal  environment  cannot  be  completely  controlled  and  will  change  over  time,  usually  getting 
hotter.  A  typical  design  range  is  15°C  to  45°C.  That  kind  of  range  has  a  large  impact  on  the  design  of 
ovens  and  heat  conduction  paths.  A  clock  that  will  only  run  at  23  ±  2°C  would  be  hard  to  sell  to  a  satellite 
maker,  since  it  places  exceptional  demands  on  his  thermal  design.  He  will  be  agreeable  with  designing  for 
that  range,  but  not  with  having  the  mission  dependent  on  making  it  100%  of  the  time.  One  way  around  the 
problem  is  to  design  a  thermal  control  package  into  the  clock.  The  GPS  Block  IIR  rubidium  clocks  have 
built-in  baseplate  thermal  control  that  allows  them  to  work  well  over  a  10°C  range. 

The  other  performance  aspect  of  thermal  design  is  the  stability  of  the  clock  as  the  temperature  of  its 
mounting  plate  changes.  Reference  clocks  in  high  performance  applications  on  the  ground  are  usually  in 
well-controlled  environments.  Long-term  stability  for  time  keeping  is  often  greatly  improved  when 
temperature  and  humidity  changes  can  be  limited.  The  Naval  Observatory,  for  example,  keeps  its  clocks  in 
environmental  chambers  where  the  temperature  excursions  are  normally  less  than  1  degree  and  humidity  is 
controlled  to  within  1%.  The  typical  satellite  temperature  swing  of  several  degrees  peak  to  peak  over  an 
orbit  can  be  significant.  A  temperature  coefficient  of  Ixl0'14/°C  is  considered  very  good  for  current  space 
cesium  and  rubidium  clocks.  A  clock  designed  to  be  stable  to  parts  in  10‘13  with  that  kind  of  temperature 
coefficient  would  be  seriously  degraded.  The  solution  can  be  a  mix  of  reducing  the  sensitivity  of  the  clock 
and  adding  thermal  isolation  hardware. 


Radiation 

Radiation  effects  in  clocks  are  unique  to  space.  They  affect  the  clock  in  several  ways.  The  first  is  that  they 
drive  the  parts  selection  and  in  some  cases  the  circuit  design  philosophy.  A  part  that  fails  or  changes 
parameters  outside  of  acceptable  bounds  due  to  radiation  within  the  design  life  is  not  acceptable.  Most 
semiconductors  used  in  commercial  clocks  today  are  not  radiation  hard.  Radiation  also  affects  clocks  in 
more  subtle  ways.  A  crystal  oscillator  used  as  a  flywheel  in  an  atomic  clock  will  change  frequency  when 
hit  with  a  burst  of  radiation.  If  the  time  constant  of  the  control  loop  is  longer  than  the  time  it  takes  the 
crystal  to  change  frequency,  the  clock  unlocks.  Another  effect  is  darkening  of  glassware.  Darkening  of  the 
glass  cells  degraded  early  space  rubidium  clocks. 

Radiation  sensitivity  is  a  parameter  that  impacts  design  life.  A  part  that  is  acceptable  for  a  1-  or  2-year 
flight  experiment  or  demonstration  is  likely  not  acceptable  for  a  mission  with  a  10-year  design  life.  The 
parts  selection  issue  drives  two  additional  problems.  The  first  is  that  hardened  versions  are  not  available 
for  most  semiconductor  parts.  The  ones  that  are  available  are  not  usually  the  most  recent  parts.  With  most 
modem  clocks  being  computer-based  designs,  the  speed  and  memory  available  for  ground  use  simply 
aren’t  achievable  in  space  parts.  The  second  problem  is  that  even  the  parts  that  are  available  aren’t  usually 
available  quickly  or  in  small  quantities.  Major  satellite  programs  work  around  this  by  encouraging 
designers  for  all  payload  boxes  to  use  parts  from  a  list  of  selected  parts  that  the  prime  contractor  will  buy  in 
quantity.  The  issue  for  the  clock  designer  is  that  he  must  find  ways  to  meet  his  needs  with  what  he  can 
obtain. 

One  other  impact  on  clock  design  from  radiation  is  the  need  to  build  in  a  method  to  recover  from  a  burst  of 
radiation.  Military  designers  have  concerns  about  manmade  events,  but  even  a  clock  in  a  commercial 
satellite  must  contend  with  solar  flares  and  single  event  upsets.  If  the  clock  experiences  a  change  due  to 
radiation,  the  electronics  must  be  able  to  correct  it.  Small  radiation  bursts  may  only  limit  the  time  constant 
of  the  servo  loop.  Larger  effects  require  the  designer  to  build  in  a  method  to  recognize  the  upset  and 
recover  with  minimal  loss  of  performance.  Microprocessors  and  their  associated  digital  components  are  of 
concern,  since  changing  a  single  bit  in  memory  or  having  the  processor  lose  its  place  in  the  program 
sequence  can  have  disastrous  effects  on  clock  operation. 
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Reliability 


As  mentioned  previously,  one  of  the  major  factors  in  the  reliability  of  space  clocks  is  thermal  design. 
Another  key  factor  is  the  selection  of  parts.  Some  parts  such  as  plastic  body  semiconductors  are  inherently 
less  reliable  than  others.  Traditionally,  parts  for  space  electronic  boxes  were  chosen  from  pre-approved 
lists  published  by  NASA  or  other  military  program  offices.  With  the  recent  trends  away  from  military 
standards,  these  restrictions  are  less  obvious,  but  the  need  to  design  with  proven  parts  remains.  It  simply 
doesn’t  make  sense  to  spend  millions  of  dollars  to  launch  a  satellite  that  is  likely  to  fail  early. 

Like  the  radiation-hardened  parts,  high  reliability  parts  are  difficult  to  obtain.  Again,  the  solution  has  been 
to  do  block  buys  of  common  parts  for  a  satellite  system.  And,  again,  the  problem  for  the  clock  builder  is 
getting  the  performance  he  needs  from  available  components.  The  need  to  fly  proven  parts  also  limits  the 
available  technology  to  things  that  already  have  a  good  history.  This  tends  to  eliminate  the  newest,  and 
often  most  attractive  parts. 


OPERATIONS 

Telemetry 

Clocks  in  a  satellite  environment  need  to  be  monitored,  just  as  those  we  use  here  on  earth  are.  The 
problem  is  the  availability  of  useful  information.  In  most  satellites,  telemetry  data  bandwidth  is  tightly 
controlled.  The  rubidium  and  cesium  clocks  flying  in  GPS  only  have  a  few  of  the  internal  analog  monitors 
available  in  the  data  stream  and  these  are  a  reduced  resolution.  Figure  1  shows  an  example  of  a  GPS 
Block  HR  rubidium  clock’s  light  monitor  as  it  can  be  seen  in  the  laboratory  and,  below,  as  it  is  seen 
through  the  telemetry  outputs.  The  sharp  breaks  that  indicate  a  frequency  jump  has  occurred  in  the  clock 
are  clearly  observable  in  the  laboratory  data  (upper  trace)  and  entirely  missing  in  the  telemetry  stream 
(lower  trace)  due  to  available  resolution. 

The  newer  processor-based  clocks  have  the  potential  to  get  around  that  limitation  by  providing  data  to  the 
host  vehicle  in  digital  format.  While  downlink  bandwidth  will  still  be  a  limited  commodity,  the  clock  can 
be  commanded  to  output  the  required  data  at  a  useful  resolution  at  a  rate  compatible  with  the  host. 

A  bigger  problem  with  the  telemetry  is  the  overall  usefulness  of  the  downlinked  data.  The  satellite 
operator  needs  simple  indicators  that  let  him  know  that  the  clock  is  either  working  properly  or  has  failed. 
He  wants  to  be  able  to  trust  the  information  he  gets  and  doesn’t  want  to  have  to  do  a  lot  of  analysis.  He’d 
also  like  to  know  how  much  life  is  left  in  the  clock  so  he  can  plan  for  a  smooth  replacement  when  it  nears 
end  of  life.  These  are  problems  for  any  clock.  Those  who  have  run  cesium  clocks  know  that  the  green 
lights  on  the  front  have  been  of  limited  value.  While  they  rarely  indicated  a  bad  clock  was  good,  it  has 
been  very  common  to  see  the  “alarm”  indicator  lit  on  a  reasonably  healthy  clock.  The  challenge  for  the 
space  clock  designer  is  to  use  to  available  state-of-health  data  to  provide  useful  information.  One 
possibility  that  has  appeared  in  commercial  digital  clocks  is  the  creation  of  a  performance  indicator  that 
produces  a  value  similar  to  an  Allan  deviation.  It  could  give  an  internal  indication  of  the  stability  of  the 
clock. 
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Operating  Experience 


Another  issue  with  space  hardware  in  general  is  demonstrated  ability.  The  designer  of  an  operational 
satellite  system  such  as  GPS  or  MELSTAR  will  be  very  unwilling  to  fly  unproven  technology  in  a  function 
critical  to  mission  success.  The  problem  is  how  to  gain  experience  with  a  technology  in  space  that  has  no 
experience  base. 

There  are  several  approaches  to  the  problem.  First,  a  technology  such  as  cesium-beam  or  rubidium  gas  cell 
clocks  that  has  extensive  operational  use  in  terrestrial  applications  has  a  big  advantage  over  an  all-new 
concept.  The  issues  with  these  clocks  have  been  primarily  engineering.  For  a  concept  such  as  optical 
pumping,  ion  storage,  or  cold  atoms,  the  problem  grows  into  convincing  the  user  that  the  technology  works 
anywhere  outside  the  laboratory.  There  are  no  widely  used  clocks  generally  available  using  these 
technologies.  Here,  the  approach  that  makes  the  most  sense  is  a  multi-step  process  where  new  ideas  are 
demonstrated  on  technology  satellites  or  experiments  on  other  satellites  before  being  used  in  operational 
systems.  Good  examples  of  this  process  are  the  Navigation  Technology  satellites  flown  by  NRL  that 
demonstrated  the  rubidium  and  cesium  clocks  now  used  in  the  operational  GPS  system  [1,4].  The  PARCS 
experiment  [5]  on  the  International  Space  Station  is  another  excellent  way  to  get  a  feel  for  the  way 
advanced  concepts  can  work  in  the  space  environment. 


On-Orbit  Analysis  Tools 

Performance  of  the  clock  on-orbit  needs  to  be  monitored,  preferably  independently  of  the  spacecraft 
function  the  clock  supports.  That  is,  if  the  clock  is  used  as  the  time  and  frequency  reference  for  a 
communications  system,  it  is  desirable  to  monitor  the  time  and  frequency  of  the  clock  by  a  means  other 
than  whether  or  not  the  communications  system  works.  In  GPS,  the  monitor  station  data  are  processed  by 
NRL  to  determine  the  phase  of  the  clocks  over  time  [6].  This  process  is  done  by  comparing  the  measured 
pseudoranges  and  computed  positions  from  the  post-fit  NIMA  orbits  to  determine  the  true  offset  and 
stability  of  the  clock.  Other  applications  will  require  different  approaches,  but  the  ability  to  monitor  the 
clock’s  performance  is  crucial  to  using  it  successfully. 


TESTING 

Space  electronic  packages  are  rigorously  tested  at  the  time  of  manufacture  and  when  integrated  into  the 
vehicle.  The  impact  on  the  usefulness  of  the  satellite  is  too  high  to  take  unnecessary  risks.  The  trade-off  is 
the  additional  cost  and  schedule  time  needed  to  do  the  testing.  The  philosophy  issues  of  testing  satellite 
hardware  extend  to  the  clocks.  No  one  wants  to  launch  a  package  with  known  problems.  Even  worse,  no 
one  wants  to  realize  after  launch  that  the  testing  done  was  not  adequate  to  detect  problems.  A  commercial 
clock  maker  will  balance  the  risk  of  delivering  a  bad  clock  to  a  customer  with  the  cost  of  replacing  it  under 
warranty.  A  laboratory  clock  is  usually  built  in  a  process  where  design  flaws  are  detected  and  corrected 
over  its  life.  Neither  of  these  approaches  works  well  in  space. 

Space  hardware  testing  is  broken  into  two  phases  [7].  The  first  is  qualification.  Here,  the  design  itself  is 
tested  at  levels  of  stress  higher  than  expected  in  operation.  The  idea  is  to  verify  that  the  design  works  and 
has  adequate  margin  for  production  and  normal  use.  The  next  phase  is  acceptance  testing.  The  concept 
for  acceptance  is  that  the  design  is  already  proven;  what  needs  to  be  done  is  to  verify  that  this  particular 
unit  has  no  manufacturing  defects.  For  this  concept  to  work,  the  manufacturing  process  must  be  carefully 
controlled  so  that  there  is  no  question  that  the  unit  under  test  was  built  to  the  design  that  was  qualified. 


12 


Acceptance  testing  is  designed  to  find  things  like  bad  solder  joints,  bad  parts,  and  improper  setup.  If  a 
design  problem  is  discovered  in  qualification,  the  qualification  test  is  redone  on  the  modified  design.  If  a 
problem  is  discovered  in  acceptance  testing  and  is  clearly  not  a  design  issue,  the  acceptance  test  is  repeated 
on  the  repaired  unit.  The  issues  that  arise  in  these  tests  are  which  tests  in  the  test  sequences  have  to  be 
repeated.  For  instance,  if  clock  fails  the  stability  test  in  thermal  vacuum  and  has  a  component  replaced, 
does  the  vibration  test  have  to  be  repeated?  The  conservative  approach  is  that  the  whole  sequence  is 
repeated,  because  the  clock  had  to  be  at  least  partially  disassembled  and  reassembled  to  repair  the  problem. 
In  practice,  when  money  and  schedules  are  tight,  there  is  a  rationalizing  of  the  risks  and  less  stringent 
sequence  is  sometimes  done.  The  clock  designer  should  design  with  testing  in  mind.  Things  like  making 
internal  monitors  externally  accessible  can  make  it  easier  to  determine  what’s  right  and  wrong  with  a  clock 
after  assembly  and  initial  testing. 

A  more  recent  testing  challenge  is  testing  embedded  software.  There  are  standard  techniques  for  finding 
unexpected  states  and  outcomes  in  digital  hardware,  but  the  process  for  testing  embedded  software  in 
systems  for  these  conditions  is  still  in  its  infancy.  Hardware  and  software  must  be  analyzed  as  a  system, 
because  the  software  executes  in  response  to  external  events;  that  is,  the  correctness  of  a  computation 
depends  on  its  input.  System  qualification  must  include  a  methodology  that  models  the  complete  system, 
hardware  and  software.  Performance  verification  must  be  supported  by  an  analysis  as  well  as  test,  and 
should  be  a  required  part  of  the  qualification  process. 

Another  issue  in  testing  is  how  much  is  done  by  the  factory  and  how  much  is  done  by  the  customer.  Most 
vehicle  contractors  will  require  the  clock  maker  to  perform  acceptance  testing  prior  to  delivery.  Normally, 
the  clock  will  tested  again  over  a  more  limited  set  of  parameters  after  delivery  and  then  once  more  as  part 
of  the  satellite  when  it’s  integrated.  These  sorts  of  tests  are  usually  functional  tests  to  determine  if  the 
device  still  works.  The  performance  is  not  evaluated,  so  it  is  difficult  to  tell  if  the  unit  still  works  as  it 
should.  The  issues  here  are  the  cost  and  time  required  for  the  testing.  The  concerns  are  that  tests  like 
spacecraft  vibration  have  a  cumulative  effect  on  the  clock. 

Life  testing  is  an  approach  to  resolving  the  lack  of  flight  experience  in  a  design.  GPS  Block  HR  rubidium 
clocks  were  an  all-new  design  with  no  flight  experience.  A  life  test  program  was  designed  for  these  clocks 
at  NRL  to  reduce  the  risk  of  flying  them  and  to  gather  information  about  how  they  operated  that  could  be 
used  by  the  GPS  operators  [8].  In  a  strict  statistical  sense,  such  a  life  test  has  limited  value,  because  the 
number  of  clocks  tested  is  small.  What  can  happen  is  that  an  early  failure  of  a  single  clock  in  a  small  set 
will  drive  the  statistics  to  indicate  a  very  poor  lifetime  prediction.  On  the  other  hand,  lack  of  failures  in  a 
small  number  of  clocks  does  not  completely  prove  that  clocks  are  unlikely  to  experience  problems.  What 
these  tests  really  accomplish  is  to  give  the  system  designers  and  operators  a  detailed  sense  of  how  the 
clocks  will  run  over  a  long  period  of  time.  As  mentioned  earlier,  the  available  telemetry  from  a  clock  in  a 
satellite  is  sparse  and  has  poor  resolution.  A  test  on  the  ground  can  be  highly  instrumented  to  include 
factory  test  points,  high-resolution  measurements,  and  tight  environmental  controls.  In  addition  to  normal 
operations,  it  is  also  possible  to  generate  unusual  test  scenarios  that  will  occur  rarely  in-orbit,  such  as 
voltage  bus  jumps,  large  temperature  excursions,  and  bad  command  sequences.  This  capability  allows 
detailed  re-creation  of  problems  seen  on-orbit  and  also  allows  controlled  testing  of  anticipated  situations. 


SUMMARY  AND  FUTURE  PROSPECTS 

Space  clocks  really  are  different.  In  general,  they  are  harder  to  build,  they  must  work  in  an  unusual 
environment,  and  failures  are  not  just  warranty  issues.  Table  1  summarizes  the  differences.  One  of  the 
consequences  is  that  space  clocks  are  more  expensive,  usually  by  a  factor  of  at  least  10.  Consequently, 
there  aren’t  very  many.  Higher  production  volume  could  reduce  the  costs,  but  at  this  time,  only  GPS  and 
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MILSTAR  fly  atomic  clocks.  The  limited  demand  means  a  very  limited  number  of  suppliers.  The  market 
is  sporadic  at  best  and  there  is  no  guarantee  that  the  clock  purchased  a  year  ago  will  available  next  year. 


Radiation 

Hardening 

Thermal 

Design 

Reliability 

Quality 

Vibration 

Testing 

Ground 

No 

Relies  on  Air 

ISO  Standard 

Limited 

ISO  Standard 

Space 

Experiment 

Limited 

Limited 

Limited 

One  of  Kind 

Survival 

Detailed 

Space 

Qualified 

Thorough 

Analysis 

Thorough 

Analysis 

>7  Years 

Full 

Documentation 

■ 

Tablet.  Comparison  Matrix. 


GPS  is  also  proving  to  be  its  own  worst  enemy  in  the  case  of  clocks.  GPS  needs  very  good  space  clocks. 
The  availability  of  highly  accurate  time  from  GPS  means  that  not  only  are  ground  users  becoming 
dependent  upon  inexpensive  GPS  receiver  vice  expensive  atomic  clocks,  but  other  space  users  can  use 
GPS  on-board  instead  of  a  space  atomic  clock.  The  absence  of  those  needs  from  the  market  makes  it  more 
difficult  and  expensive  for  GPS  to  obtain  flight  clocks.  Cost,  schedule,  and  development  factors  deter  the 
use  of  newer  clock  technologies.  At  the  same  time,  the  obsolescence  of  parts  and  manufacturing  methods 
makes  it  difficult  to  buy  the  old  ones. 

The  situation  is  aggravated  by  the  government’s  approach  to  buying  satellite  systems.  That  approach 
makes  the  contractor  responsible  for  the  system  working  and  leaves  most  of  its  design  to  him.  The  idea 
seems  reasonable,  but  the  problem  is  that  there  is  no  continuity.  The  prime  contractor  that  builds  one 
block  of  satellites  may  not  be  the  one  who  builds  the  next.  Each  contractor  will  use  his  own  best 
engineering  judgment  and  may  well  pick  different  clock  vendors.  The  end  result  is  too  little  demand 
spread  over  several  sources.  No  one  source  gets  the  resources  or  continuity  of  production  needed  to 
sustain  them. 

Several  solutions  have  been  discussed.  One  is  for  the  government  to  buy  clocks  and  supply  them  to 
whoever  builds  satellites  that  need  them.  That  could  focus  the  effort  better,  but  has  in  the  past  relieved  the 
satellite  contractor  of  the  responsibility  for  a  key  system  component  and  subsequently  the  system 
performance.  This  approach  has  presented  major  problems  in  contracting  and  sticky  legal  issues.  An 
alternative  approach  in  today’s  changed  government-industry  environment  may  be  possible  in  giving  the 
contractor  more  flexibility  in  design  participation  and  accepting  units  by  test  or  other  such  means.  Such  a 
government  provided  approach  could  mitigate  responsibility  issues.  But  even  with  a  single  vendor  getting 
all  the  business,  that  may  not  be  adequate  to  support  a  viable  source  and  has  the  downside  of  relying  on  a 
single  small  company  for  a  critical  component.  Another  approach  is  for  the  government  to  actually  build 
the  clocks  in  a  government  lab.  That  solves  the  problem  of  keeping  a  vendor  going,  but  still  raises 
concerns  prime  contractor  responsibility. 

There  probably  are  no  100%  solutions.  Until,  and  if,  the  market  for  space  clocks  grows  to  the  point  where 
vendors  can  see  enough  business  to  justify  their  continuing  investment  to  produce  space  clocks,  the 
government  will  have  to  play  a  significant  part  in  the  process.  Currently  NRL  supports  the  GPS  Joint 
Program  Office  for  clock  development  with  a  roadmap  program  for  future  clocks  that  provides  engineering 
work  for  vendors  and  designs  clocks  for  future  use  in  the  program  [9].  NIST  and  the  Aerospace 
Corporation  also  provide  technology  support. 
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Figure  1.  Telemetry  Example. 
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Questions  and  Answers 


DEMETRIOS  MATSAKIS  (U.S.  Naval  Observatory):  I  just  wondered  if  you  have  any  statistics  on  how 
often  those  different  criteria  actually  fail  when  people  try  to  go  to  space.  Like  how  often  do  vibrations  kill  a 
clock,  despite  having  done  all  those  tests? 

JOE  WHITE:  Once  they  get  launched,  if  you  do  it  right,  very  rarely.  The  first  vibration  test  on  a  new 
design  almost  always  fails.  But  once  you  have  been  through  the  qualification  process,  generally  you  do  not 
have  problems  after  that. 

MATSAKIS:  [Inaudible] 

WHITE:  Yes,  more  or  less.  If  you  do  the  qualification  design  properly  and  you  have  got  your  quality  work, 
your  standards  for  building  the  clock  in  place  will  have  relatively  few  problems.  You  will  have  some 
statistical  outliers  as  things  go  along.  You  do  not  see  many  major  problems. 

MICHAEL  GARVEY  (Datum  TT&M):  One  thing  that  often  gets  neglected,  and  the  guys  at  NRL  are  big 
proponents  of  it,  is  life-testing. 

WHITE:  Yes. 

GARVEY :  ...  It  is  expensive,  it  takes  a  long  time,  it  needs  to  be  started  early,  and  it  is  one  of  the  first  things 
to  get  cut. 

WHITE:  And,  statistically,  it  is  a  problem  because  you  life-test  on  a  small  number  of  units. 

GARVEY:  Right.  But  it  is  where  you  pick  up  some  of  the  long-term  reliability  problems  that  do  not  come 
out  of  analysis. 

WHITE:  And  the  design  features,  things  that  you  sort  of  designed  into  it,  but  you  did  not  realize  were  going 
to  work  quite  the  way  they  do. 

GARVEY:  Right. 

JIM  CAMPARO  (The  Aerospace  Corporation):  Could  you  say  anything  about  mean  time  between  failures 
for  space-qualified  clocks?  What  experience  we  have,  and  what  we  might  know  about  that? 

WHITE:  There  is  a  lot  of  GPS  experience,  and  it  doesn’t  fit  the  traditional  mold.  I  don’t  know  if  I  have  got 
enough  time  to  really  get  into  it.  The  problem  with  most  of  the  clocks  that  GPS  flies  is  that  the  physics  units 
do  not  have  the  statistical  background  that  you  have  on  a  commercial  clock  to  come  up  with  these  kind  of 
numbers.  The  circuit  boards  you  can  do  that  for,  and  generally  that  is  not  where  the  failures  are.  The 
failures  tend  to  be  things  like  running  out  of  cesium,  radiation  effects  you  didn’t  quite  expect,  particularly  in 
the  early  days  of  GPS.  So  there  are  lifetime  numbers,  and  typically  it  is  years  for  those  kinds  of  things,  but 
it  is  a  very  complex  process.  Let’s  talk  off-line. 
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